Require Physical 2fa for Build WG & Web Infra members

[flakey5]

Members of the Build WG & @nodejs/web-infra have access to sensitive resources. Despite this however, there aren't any actual requirements for 2fa to be enabled on a member's accounts afaik.

I think there should be a requirement for members to have some form of physical 2fa (i.e. yubikey) connected to their GitHub and other relevant accounts.

@nodejs/web-infra is relevant here since, even though members aren't under the Build WG governance, they still follow the Build WG contributor guidelines as per the website's governance doc.

I don't have an answer as to who's going to be paying for the keys however

[jasnell]

Everyone in the Node.js GitHub org is, as far as I can remember, required to have general 2fa enabled on their accounts. Physical keys would be a good additional layer for folks on the build/infra/release teams. The foundation can likely be asked to pay for the keys. /cc @mcollina

[MattIPv4]

+1 to requiring physical hardware for authentication -- I have YubiKeys on my GH account. I wish GH had a way at the org level to require that 2FA on accounts is a physical factor, and can't be bypassed with another factor like GH mobile (it always gives me this option for sudo mode which scares me).

[ovflowd]

+1 for Web Infra. We should also require 2fa (Physical) on 1Password which has access to Vercel and Sentry and our GitHub bot accounts.

[mcollina]

Despite this however, there aren't any actual requirements for 2fa to be enabled on a member's accounts afaik.

I think this should be a requirement.

I don't think there is money available to massively buy yubykeys for everyone, but it really depends on the volume.

[jasnell]

... massively buy yubikeys for everyone...

We don't need them for everyone... just for the build, build-infra, web-infra, and release teams I would imagine. That would be about 25 keys, which should come to just under about $2k.

[richardlau]

While requiring a physical key would increase security, I also think it would discourage volunteering. I have a physical Yubikey that I'm not using because it looks like it's not so straightforward to get it working under WSL.

[ovflowd]

I think we should have a flexible requirement either have a Passkey or a Yubikey. Passkeys are already more secure and usually tied to Devicesd (iOS Phones, Windows computers, Android phones can serve as a Passkey)